diff options
| author | Karl Mehltretter <kmehltretter@gmail.com> | 2026-08-11 11:55:32 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@kernel.org> | 2026-09-07 21:53:05 +0200 |
| commit | 135d9e67f7ab4f261c2157ee2de1f93a4de39a41 (patch) | |
| tree | 42db3ab9d149829f0a0488342c0a99eedecaad38 /include/uapi/linux | |
| parent | c6d93e52d8c8f05898adf29d3b6edf6570da83af (diff) | |
| download | linux-next-135d9e67f7ab4f261c2157ee2de1f93a4de39a41.tar.gz linux-next-135d9e67f7ab4f261c2157ee2de1f93a4de39a41.zip | |
irqchip/gic-v3-its: Don't WARN on LPI free allocation failure
free_lpi_range() cannot give LPIs back to the allocator without
allocating a struct lpi_range to describe the freed range, so it
returns -ENOMEM (its only failure mode) when that allocation fails,
and its_lpi_free() turns this into a WARN_ON().
syzbot triggers the WARN_ON() by injecting a slab allocation failure
on device teardown, which with panic_on_warn becomes a panic:
WARNING: drivers/irqchip/irq-gic-v3-its.c:2251 at its_msi_teardown+0x3a4/0x424
its_msi_teardown+0x3a4/0x424
msi_remove_device_irq_domain+0x16c/0x27c
msi_device_data_release+0x38/0x9c
The failure is transient and the consequence benign: the freed range
is simply never returned to the allocator. This does not warrant a
WARN_ON() backtrace, so log a rate-limited error instead.
Fixes: 880cb3cddd16 ("irqchip/gic-v3-its: Refactor LPI allocator")
Reported-by: syzbot+229d761b8a110e6de517@syzkaller.appspotmail.com
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: Claude:claude-fable-5
Link: https://patch.msgid.link/20260811095532.48454-1-kmehltretter@gmail.com
Closes: https://syzkaller.appspot.com/bug?extid=229d761b8a110e6de517
Diffstat (limited to 'include/uapi/linux')
0 files changed, 0 insertions, 0 deletions
